fdai-deployment-cli 0.1.2__py3-none-any.whl

fdai_deployment_cli/operational_evidence_verifier_input.py

@@ -0,0 +1,575 @@
+"""Reviewed deployment input for the optional operational evidence verifier."""
+
+from __future__ import annotations
+
+import json
+import re
+from collections.abc import Mapping
+from dataclasses import dataclass
+from pathlib import Path
+from typing import Any
+
+from fdai_deployment_cli.contracts import canonical_digest
+from fdai_deployment_cli.private_output import read_private_bytes
+from fdai_deployment_cli.standalone_host_state import replace_or_verify_private_json
+
+_SCHEMA = "fdai.operational-evidence-verifier-deployment-input.v1"
+_STAGED_SCHEMA = "fdai.operational-evidence-verifier-staged-input.v1"
+_MAX_INPUT_BYTES = 256 * 1024
+_DIGEST = re.compile(r"[0-9a-f]{64}")
+_GUID = re.compile(r"[0-9a-fA-F]{8}(?:-[0-9a-fA-F]{4}){3}-[0-9a-fA-F]{12}")
+_GUID_FRAGMENT = r"[0-9a-fA-F]{8}(?:-[0-9a-fA-F]{4}){3}-[0-9a-fA-F]{12}"
+_RESOURCE_GROUP_NAME = r"[A-Za-z0-9_.()-]{1,90}"
+_RESOURCE_SCOPE = re.compile(
+    rf"/subscriptions/{_GUID_FRAGMENT}/resourceGroups/{_RESOURCE_GROUP_NAME}"
+    r"(?:/providers/[A-Za-z0-9.]+/[A-Za-z0-9_.()/:-]+)?"
+)
+_FIXED_VERIFIER_ROLE = "fdai_operational_evidence_verifier"
+_TOP_FIELDS = frozenset(
+    {
+        "schema_version",
+        "trust_registry_path",
+        "trust_registry_pin",
+        "grant_registry_path",
+        "grant_registry_pin",
+        "anchors",
+        "caller_token_issuer",
+        "caller_token_audience",
+        "caller_token_jwks",
+        "role_readback_scopes",
+        "allowed_role_scopes",
+        "vertical_executor_principal_ids",
+        "writer_members",
+        "dev_gateway_executor_principal_id",
+        "verifier_database_role",
+    }
+)
+_ANCHORS_FIELDS = frozenset({"schema_version", "venue", "anchors"})
+_ANCHOR_FIELDS = frozenset({"anchor_id", "principal_id", "evidence_class"})
+_OPTIONAL_TOP_FIELDS = frozenset(
+    {
+        "grant_registry_json",
+        "observation_metric_workspace_id",
+        "observation_metric_queries_json",
+        "observation_scope_rows_json",
+        "forecast_history_sources_json",
+    }
+)
+_BINDING_FIELDS = frozenset(
+    {
+        "enabled",
+        "trust_registry_path",
+        "trust_registry_pin",
+        "grant_registry_path",
+        "grant_registry_pin",
+        "anchors_json",
+        "caller_token_issuer",
+        "caller_token_audience",
+        "caller_token_jwks_json",
+        "role_readback_scopes_json",
+        "allowed_role_scopes_json",
+        "vertical_executor_principals_json",
+        "writer_members_json",
+        "dev_gateway_executor_principal_id",
+    }
+)
+_SECRET_JWK_FIELDS = frozenset({"d", "p", "q", "dp", "dq", "qi", "k"})
+_ALLOWED_ROLE_NAMES = frozenset(
+    {"AcrPull", "Key Vault Secrets User", "Reader", "Monitoring Reader"}
+)
+
+
+@dataclass(frozen=True, slots=True)
+class OperationalEvidenceVerifierDeploymentInput:
+    """Validated authority-neutral binding for the read-only verifier workload."""
+
+    binding: dict[str, object]
+    input_digest: str
+
+
+def load_operational_evidence_verifier_input(
+    path: Path,
+) -> OperationalEvidenceVerifierDeploymentInput:
+    """Load one private reviewed verifier input from the operator-selected path."""
+
+    raw = _load_json_object(
+        path,
+        "operational evidence verifier deployment input",
+    )
+    return _from_mapping(raw, staged=False)
+
+
+def staged_operational_evidence_verifier_input_from_path(
+    path: Path | None,
+) -> OperationalEvidenceVerifierDeploymentInput | None:
+    """Load a staged managed-host input, or report that the verifier was not selected."""
+
+    if path is None:
+        return None
+    raw = _load_json_object(
+        path,
+        "staged operational evidence verifier deployment input",
+    )
+    return _from_mapping(raw, staged=True)
+
+
+def stage_operational_evidence_verifier_input(
+    value: OperationalEvidenceVerifierDeploymentInput | None,
+    *,
+    tunnel: Any,
+    prepared_root: Path,
+    remote_root: str,
+) -> tuple[str, ...]:
+    """Copy the reviewed non-secret input to the managed host and return CLI arguments."""
+
+    if value is None:
+        return ()
+    staged: dict[str, object] = {
+        "schema_version": _STAGED_SCHEMA,
+        "input_digest": value.input_digest,
+        "binding": value.binding,
+    }
+    local_path = prepared_root / "operational-evidence-verifier-input.json"
+    remote_path = f"{remote_root}/operational-evidence-verifier-input.json"
+    replace_or_verify_private_json(local_path, staged)
+    tunnel.copy_to(local_path, remote_path, timeout=120)
+    return ("--operational-evidence-verifier-input", remote_path)
+
+
+def apply_operational_evidence_verifier_input(
+    values: dict[str, object],
+    verifier_input: OperationalEvidenceVerifierDeploymentInput | None,
+) -> None:
+    """Populate Terraform and application values only when the input is selected."""
+
+    if verifier_input is None:
+        return
+    values["enable_operational_evidence_verifier"] = True
+    values["operational_evidence_verifier"] = dict(verifier_input.binding)
+
+
+def reconcile_retained_operational_evidence_verifier_input(
+    verifier_input: OperationalEvidenceVerifierDeploymentInput | None,
+    *,
+    retained: dict[str, object],
+    values: dict[str, object],
+) -> bool:
+    """Bind a newly selected verifier input onto a retained host context or fail on drift."""
+
+    previous = retained.get("oev_input_digest", "")
+    if not isinstance(previous, str):
+        raise ValueError("standalone host retained context differs")
+    current = verifier_input.input_digest if verifier_input is not None else ""
+    if previous and previous != current:
+        raise ValueError("standalone host retained context differs")
+    if verifier_input is None:
+        return False
+    apply_operational_evidence_verifier_input(values, verifier_input)
+    if previous == current:
+        return False
+    retained["oev_input_digest"] = current
+    return True
+
+
+def _from_mapping(
+    value: Mapping[str, Any], *, staged: bool
+) -> OperationalEvidenceVerifierDeploymentInput:
+    if staged:
+        if set(value) != {"schema_version", "input_digest", "binding"}:
+            raise ValueError("operational evidence verifier input fields are invalid")
+        if value.get("schema_version") != _STAGED_SCHEMA:
+            raise ValueError("operational evidence verifier input schema is unsupported")
+        binding = _staged_binding(
+            _mapping(value["binding"], "operational evidence verifier binding")
+        )
+        material = {
+            "schema_version": _SCHEMA,
+            **_input_material_from_binding(binding),
+        }
+        digest = canonical_digest(material)
+        if value.get("input_digest") != digest:
+            raise ValueError("operational evidence verifier input digest differs")
+        return OperationalEvidenceVerifierDeploymentInput(binding=binding, input_digest=digest)
+    if not _TOP_FIELDS.issubset(value) or not set(value).issubset(
+        _TOP_FIELDS | _OPTIONAL_TOP_FIELDS
+    ):
+        raise ValueError("operational evidence verifier input fields are invalid")
+    if value.get("schema_version") != _SCHEMA:
+        raise ValueError("operational evidence verifier input schema is unsupported")
+    _reject_secret_material(value)
+    binding = _binding(value)
+    material = {
+        "schema_version": _SCHEMA,
+        **_input_material_from_binding(binding),
+    }
+    return OperationalEvidenceVerifierDeploymentInput(
+        binding=binding,
+        input_digest=canonical_digest(material),
+    )
+
+
+def _staged_binding(value: Mapping[str, Any]) -> dict[str, object]:
+    if (
+        not _BINDING_FIELDS.issubset(value)
+        or not set(value).issubset(_BINDING_FIELDS | _OPTIONAL_TOP_FIELDS)
+        or value.get("enabled") is not True
+    ):
+        raise ValueError("operational evidence verifier binding fields are invalid")
+    anchors = _anchors(_json_field(value, "anchors_json"))
+    caller_jwks = _caller_jwks(_json_field(value, "caller_token_jwks_json"))
+    readback_scopes = _scopes(
+        _json_field(value, "role_readback_scopes_json"), "role_readback_scopes"
+    )
+    allowed_role_scopes = _allowed_role_scopes(_json_field(value, "allowed_role_scopes_json"))
+    vertical_principals = _guid_list(
+        _json_field(value, "vertical_executor_principals_json"),
+        "vertical_executor_principal_ids",
+    )
+    writer_members = _writer_members(_json_field(value, "writer_members_json"))
+    result: dict[str, object] = {
+        "enabled": True,
+        "trust_registry_path": _path_text(value, "trust_registry_path"),
+        "trust_registry_pin": _digest(value, "trust_registry_pin"),
+        "grant_registry_path": _path_text(value, "grant_registry_path"),
+        "grant_registry_pin": _digest(value, "grant_registry_pin"),
+        "anchors_json": _json_text(anchors),
+        "caller_token_issuer": _https_url(value, "caller_token_issuer"),
+        "caller_token_audience": _audience(value, "caller_token_audience"),
+        "caller_token_jwks_json": _json_text(caller_jwks),
+        "role_readback_scopes_json": _json_text(readback_scopes),
+        "allowed_role_scopes_json": _json_text(allowed_role_scopes),
+        "vertical_executor_principals_json": _json_text(vertical_principals),
+        "writer_members_json": _json_text(writer_members),
+        "dev_gateway_executor_principal_id": _guid(value, "dev_gateway_executor_principal_id"),
+    }
+    result.update(_optional_binding_fields(value))
+    return result
+
+
+def _binding(value: Mapping[str, Any]) -> dict[str, object]:
+    trust_pin = _digest(value, "trust_registry_pin")
+    grant_pin = _digest(value, "grant_registry_pin")
+    anchors = _anchors(value["anchors"])
+    caller_jwks = _caller_jwks(value["caller_token_jwks"])
+    readback_scopes = _scopes(value["role_readback_scopes"], "role_readback_scopes")
+    allowed_role_scopes = _allowed_role_scopes(value["allowed_role_scopes"])
+    vertical_principals = _guid_list(
+        value["vertical_executor_principal_ids"],
+        "vertical_executor_principal_ids",
+    )
+    writer_members = _writer_members(value["writer_members"])
+    verifier_role = _text(value, "verifier_database_role")
+    if verifier_role != _FIXED_VERIFIER_ROLE:
+        raise ValueError("operational evidence verifier database role is fixed")
+    result: dict[str, object] = {
+        "enabled": True,
+        "trust_registry_path": _path_text(value, "trust_registry_path"),
+        "trust_registry_pin": trust_pin,
+        "grant_registry_path": _path_text(value, "grant_registry_path"),
+        "grant_registry_pin": grant_pin,
+        "anchors_json": _json_text(anchors),
+        "caller_token_issuer": _https_url(value, "caller_token_issuer"),
+        "caller_token_audience": _audience(value, "caller_token_audience"),
+        "caller_token_jwks_json": _json_text(caller_jwks),
+        "role_readback_scopes_json": _json_text(readback_scopes),
+        "allowed_role_scopes_json": _json_text(allowed_role_scopes),
+        "vertical_executor_principals_json": _json_text(vertical_principals),
+        "writer_members_json": _json_text(writer_members),
+        "dev_gateway_executor_principal_id": _guid(value, "dev_gateway_executor_principal_id"),
+    }
+    result.update(_optional_binding_fields(value))
+    return result
+
+
+def _optional_binding_fields(value: Mapping[str, Any]) -> dict[str, object]:
+    optional: dict[str, object] = {}
+    if "observation_metric_workspace_id" in value:
+        optional["observation_metric_workspace_id"] = _guid(
+            value, "observation_metric_workspace_id"
+        )
+    for key in (
+        "grant_registry_json",
+        "observation_metric_queries_json",
+        "observation_scope_rows_json",
+        "forecast_history_sources_json",
+    ):
+        if key in value:
+            optional[key] = _json_text(_json_field(value, key))
+    return optional
+
+
+def _input_material_from_binding(binding: Mapping[str, object]) -> dict[str, object]:
+    material: dict[str, object] = {
+        "trust_registry_path": binding["trust_registry_path"],
+        "trust_registry_pin": binding["trust_registry_pin"],
+        "grant_registry_path": binding["grant_registry_path"],
+        "grant_registry_pin": binding["grant_registry_pin"],
+        "anchors": json.loads(str(binding["anchors_json"])),
+        "caller_token_issuer": binding["caller_token_issuer"],
+        "caller_token_audience": binding["caller_token_audience"],
+        "caller_token_jwks": json.loads(str(binding["caller_token_jwks_json"])),
+        "role_readback_scopes": json.loads(str(binding["role_readback_scopes_json"])),
+        "allowed_role_scopes": json.loads(str(binding["allowed_role_scopes_json"])),
+        "vertical_executor_principal_ids": json.loads(
+            str(binding["vertical_executor_principals_json"])
+        ),
+        "writer_members": json.loads(str(binding["writer_members_json"])),
+        "dev_gateway_executor_principal_id": binding["dev_gateway_executor_principal_id"],
+        "verifier_database_role": _FIXED_VERIFIER_ROLE,
+    }
+    for key in _OPTIONAL_TOP_FIELDS:
+        if key in binding:
+            material[key] = binding[key]
+    return material
+
+
+def _anchors(value: object) -> dict[str, object]:
+    data = _mapping(value, "operational evidence anchors")
+    if set(data) != _ANCHORS_FIELDS or data.get("schema_version") != "1.0.0":
+        raise ValueError("operational evidence anchors fields are invalid")
+    if data.get("venue") != "deployed":
+        raise ValueError("operational evidence anchors must target deployed venue")
+    items = data.get("anchors")
+    if not isinstance(items, list) or not items:
+        raise ValueError("operational evidence anchors must be a non-empty list")
+    seen: set[str] = set()
+    normalized: list[dict[str, str]] = []
+    for item in items:
+        anchor = _mapping(item, "operational evidence anchor")
+        if set(anchor) != _ANCHOR_FIELDS:
+            raise ValueError("operational evidence anchor fields are invalid")
+        anchor_id = _bounded_text(anchor, "anchor_id")
+        principal = _principal_text(anchor.get("principal_id"), "principal_id")
+        evidence_class = _bounded_text(anchor, "evidence_class")
+        if not anchor_id.startswith("anchor:"):
+            raise ValueError("operational evidence anchor id is invalid")
+        if evidence_class != "live":
+            raise ValueError("operational evidence anchors must use live evidence")
+        if anchor_id in seen:
+            raise ValueError("operational evidence anchor is duplicated")
+        seen.add(anchor_id)
+        normalized.append(
+            {
+                "anchor_id": anchor_id,
+                "principal_id": principal,
+                "evidence_class": evidence_class,
+            }
+        )
+    return {"schema_version": "1.0.0", "venue": "deployed", "anchors": normalized}
+
+
+def _caller_jwks(value: object) -> dict[str, object]:
+    jwks = _mapping(value, "caller token JWKS")
+    if set(jwks) != {"keys"}:
+        raise ValueError("caller token JWKS fields are invalid")
+    keys = jwks["keys"]
+    if not isinstance(keys, list) or not keys:
+        raise ValueError("caller token JWKS must contain at least one public key")
+    normalized: list[dict[str, object]] = []
+    for item in keys:
+        key = _mapping(item, "caller token JWK")
+        if _SECRET_JWK_FIELDS & set(key):
+            raise ValueError("caller token JWKS contains secret key material")
+        if key.get("kty") in {"oct", "dir"}:
+            raise ValueError("caller token JWKS contains secret key material")
+        if not isinstance(key.get("kty"), str) or not str(key["kty"]).strip():
+            raise ValueError("caller token JWK is malformed")
+        normalized.append({str(name): member for name, member in key.items()})
+    return {"keys": normalized}
+
+
+def _allowed_role_scopes(value: object) -> dict[str, list[str]]:
+    data = _mapping(value, "allowed role scopes")
+    if not data:
+        raise ValueError("allowed role scopes are required")
+    normalized: dict[str, list[str]] = {}
+    for role, scopes in data.items():
+        if role not in _ALLOWED_ROLE_NAMES:
+            raise ValueError("allowed role scopes include an unsupported role")
+        normalized[role] = _scopes(scopes, f"allowed scopes for {role}")
+    return normalized
+
+
+def _writer_members(value: object) -> list[str]:
+    if value != [_FIXED_VERIFIER_ROLE]:
+        raise ValueError(
+            "operational evidence writer members must contain only the verifier writer"
+        )
+    return [_FIXED_VERIFIER_ROLE]
+
+
+def _guid_list(value: object, label: str) -> list[str]:
+    if not isinstance(value, list) or not value:
+        raise ValueError(f"{label} must be a non-empty list of GUIDs")
+    return [_principal_text(item, label) for item in value]
+
+
+def _scopes(value: object, label: str) -> list[str]:
+    if not isinstance(value, list) or not value:
+        raise ValueError(f"{label} must be a non-empty list")
+    scopes: list[str] = []
+    for item in value:
+        if not isinstance(item, str) or not item.strip():
+            raise ValueError(f"{label} entries must be strings")
+        scope = item.strip().rstrip("/")
+        match = _RESOURCE_SCOPE.fullmatch(scope)
+        if (
+            match is None
+            or "/resourceGroups/" not in scope
+            or _resource_group_ends_with_period(scope)
+        ):
+            raise ValueError(f"{label} entries must be exact Azure resource scopes")
+        _reject_placeholder(scope, label)
+        scopes.append(scope)
+    if len(scopes) != len(set(scopes)):
+        raise ValueError(f"{label} entries must be unique")
+    return scopes
+
+
+def _digest(value: Mapping[str, Any], field: str) -> str:
+    item = _text(value, field)
+    if _DIGEST.fullmatch(item) is None:
+        raise ValueError(f"{field} must be a lowercase SHA-256 digest")
+    _reject_placeholder(item, field)
+    return item
+
+
+def _guid(value: Mapping[str, Any], field: str) -> str:
+    return _principal_text(value.get(field), field)
+
+
+def _principal_text(value: object, field: str) -> str:
+    if not isinstance(value, str) or _GUID.fullmatch(value) is None:
+        raise ValueError(f"{field} must be a GUID")
+    _reject_placeholder(value, field)
+    return value
+
+
+def _path_text(value: Mapping[str, Any], field: str) -> str:
+    item = _text(value, field)
+    if not item or "\x00" in item or ".." in Path(item).parts or item in {"/", ".", "config"}:
+        raise ValueError(f"{field} is invalid")
+    _reject_placeholder(item, field)
+    return item
+
+
+def _https_url(value: Mapping[str, Any], field: str) -> str:
+    item = _text(value, field)
+    if not item.startswith("https://") or " " in item or item.endswith("example.com"):
+        raise ValueError(f"{field} must be an HTTPS URL")
+    _reject_placeholder(item, field)
+    return item
+
+
+def _audience(value: Mapping[str, Any], field: str) -> str:
+    item = _text(value, field)
+    if not item.startswith("api://") or len(item) > 256:
+        raise ValueError(f"{field} is invalid")
+    _reject_placeholder(item, field)
+    return item
+
+
+def _text(value: Mapping[str, Any], field: str) -> str:
+    item = value.get(field)
+    if not isinstance(item, str) or not item.strip():
+        raise ValueError(f"{field} is required")
+    return item.strip()
+
+
+def _bounded_text(value: Mapping[str, Any], field: str) -> str:
+    item = _text(value, field)
+    if len(item) > 256:
+        raise ValueError(f"{field} is too long")
+    _reject_placeholder(item, field)
+    return item
+
+
+def _mapping(value: object, label: str) -> Mapping[str, Any]:
+    if not isinstance(value, dict) or any(not isinstance(key, str) for key in value):
+        raise ValueError(f"{label} is invalid")
+    return value
+
+
+def _load_json_object(path: Path, label: str) -> dict[str, Any]:
+    data = read_private_bytes(path, max_bytes=_MAX_INPUT_BYTES)
+    if not data:
+        raise ValueError(f"{label} is empty")
+    try:
+        value = json.loads(
+            data.decode("utf-8"),
+            object_pairs_hook=_strict_json_object,
+        )
+    except UnicodeDecodeError as exc:
+        raise ValueError(f"{label} is not valid UTF-8") from exc
+    except json.JSONDecodeError as exc:
+        raise ValueError(f"{label} is not valid JSON") from exc
+    if not isinstance(value, dict):
+        raise ValueError(  # noqa: TRY004 - normalize untrusted JSON into a stable CLI error
+            f"{label} MUST be a JSON object"
+        )
+    return value
+
+
+def _strict_json_object(pairs: list[tuple[str, object]]) -> dict[str, object]:
+    value: dict[str, object] = {}
+    for key, item in pairs:
+        if key in value:
+            raise ValueError(f"duplicate JSON key: {key}")
+        value[key] = item
+    return value
+
+
+def _json_text(value: object) -> str:
+    return json.dumps(value, sort_keys=True, separators=(",", ":"))
+
+
+def _json_field(value: Mapping[str, Any], field: str) -> object:
+    raw = _text(value, field)
+    try:
+        return json.loads(raw, object_pairs_hook=_strict_json_object)
+    except json.JSONDecodeError as exc:
+        raise ValueError(f"{field} must be valid JSON") from exc
+
+
+def _resource_group_ends_with_period(scope: str) -> bool:
+    marker = "/resourceGroups/"
+    group = scope.split(marker, 1)[1].split("/", 1)[0]
+    return group.endswith(".")
+
+
+def _reject_placeholder(value: str, field: str) -> None:
+    lowered = value.casefold()
+    if (
+        set(value) <= {"0", "-"}
+        or "replace" in lowered
+        or "placeholder" in lowered
+        or "set-me" in lowered
+        or "<" in value
+        or ">" in value
+    ):
+        raise ValueError(f"{field} contains a placeholder value")
+
+
+def _reject_secret_material(value: object) -> None:
+    if isinstance(value, Mapping):
+        if any(key.casefold() in {"password", "client_secret", "private_key"} for key in value):
+            raise ValueError("operational evidence verifier input contains secret material")
+        for item in value.values():
+            _reject_secret_material(item)
+    elif isinstance(value, list):
+        for item in value:
+            _reject_secret_material(item)
+    elif isinstance(value, str):
+        lowered = value.casefold()
+        if "private key" in lowered or "client_secret" in lowered or "password=" in lowered:
+            raise ValueError("operational evidence verifier input contains secret material")
+
+
+__all__ = [
+    "OperationalEvidenceVerifierDeploymentInput",
+    "apply_operational_evidence_verifier_input",
+    "load_operational_evidence_verifier_input",
+    "reconcile_retained_operational_evidence_verifier_input",
+    "stage_operational_evidence_verifier_input",
+    "staged_operational_evidence_verifier_input_from_path",
+]

fdai_deployment_cli/plan_input.py

@@ -0,0 +1,101 @@
+"""Private, non-secret Terraform plan input snapshot."""
+
+from __future__ import annotations
+
+import os
+import re
+import stat
+from dataclasses import dataclass
+from pathlib import Path
+
+from fdai_deployment_cli.contracts import canonical_bytes, load_json_object
+from fdai_deployment_cli.target import compute_target_binding
+
+PLAN_ONLY_PASSWORD = "FDAI-PLAN-ONLY-NOT-A-SECRET"
+_REQUIRED = frozenset(
+    {
+        "region",
+        "tenant_id",
+        "subscription_id",
+        "target_binding",
+        "postgres_admin_login",
+        "postgres_admin_password",
+        "core_image",
+    }
+)
+_KEY = re.compile(r"^[a-z][a-z0-9_]{0,127}$")
+
+
+@dataclass(frozen=True, slots=True)
+class PlanInputContext:
+    """Validated provider context removed from Terraform variable content."""
+
+    subscription_id: str
+    tenant_id: str
+
+
+def snapshot_plan_input(
+    source: Path,
+    destination: Path,
+    *,
+    expected_target_binding: str,
+    expected_region: str,
+    expected_environment: str,
+) -> PlanInputContext:
+    """Validate and copy a mode-0600 JSON plan input without real secret values."""
+
+    values = read_plan_input(source)
+    if set(values) != _REQUIRED:
+        raise ValueError("Terraform plan input fields do not match the secret-free schema")
+    if any(_KEY.fullmatch(key) is None for key in values):
+        raise ValueError("Terraform plan input contains an invalid key")
+    if values["postgres_admin_password"] != PLAN_ONLY_PASSWORD:
+        raise ValueError("Terraform plan input MUST use the plan-only password placeholder")
+    tenant_id = values["tenant_id"]
+    subscription_id = values["subscription_id"]
+    if not isinstance(tenant_id, str) or not isinstance(subscription_id, str):
+        raise ValueError("Terraform plan input Azure target values MUST be strings")
+    derived_binding = compute_target_binding(
+        tenant_id=tenant_id,
+        subscription_id=subscription_id,
+    )
+    if values["target_binding"] != derived_binding or derived_binding != expected_target_binding:
+        raise ValueError("Terraform plan input target binding does not match the profile")
+    if values["region"] != expected_region:
+        raise ValueError("Terraform plan input region does not match the profile")
+    if expected_environment not in {"dev", "staging", "prod"}:
+        raise ValueError("Terraform plan input environment is unsupported")
+    terraform_values = {
+        key: value
+        for key, value in values.items()
+        if key not in {"target_binding", "subscription_id"}
+    }
+    terraform_values["env"] = expected_environment
+    write_plan_input(destination, terraform_values)
+    return PlanInputContext(subscription_id=subscription_id, tenant_id=tenant_id)
+
+
+def read_plan_input(source: Path) -> dict[str, object]:
+    """Read bounded private JSON without following links or blocking on a FIFO."""
+
+    descriptor = os.open(source, os.O_RDONLY | os.O_NOFOLLOW | os.O_NONBLOCK)
+    with os.fdopen(descriptor, "rb") as stream:
+        details = os.fstat(stream.fileno())
+        if not stat.S_ISREG(details.st_mode) or stat.S_IMODE(details.st_mode) != 0o600:
+            raise PermissionError("Terraform plan input MUST be a mode-0600 regular file")
+        payload = stream.read(1_048_577)
+    return load_json_object(payload, label="Terraform plan input")
+
+
+def write_plan_input(destination: Path, values: dict[str, object]) -> None:
+    """Persist validated plan variables exclusively with private permissions."""
+
+    output = os.open(
+        destination,
+        os.O_WRONLY | os.O_CREAT | os.O_EXCL | os.O_NOFOLLOW,
+        0o600,
+    )
+    with os.fdopen(output, "wb") as stream:
+        stream.write(canonical_bytes(values) + b"\n")
+        stream.flush()
+        os.fsync(stream.fileno())